A time-based event stream is comprised of a series of events ordered in terms of time. An event is a message including one or more attributes. An attribute can be a string or numeric type, for instance. Software application monitoring and/or diagnostic tools typically generate time-based event streams to facilitate application debugging. For example, performance counter data collected for an application can be supplied as a time-based stream, and each event can include attributes such as time stamp, application name, counter name, and counter value. In sum, the event stream provides a sequence of messages over time that describes the behavior of an application.
The sheer quantity of events typically comprising a stream makes locating pertinent information a time consuming process. For instance, in a complex distributed system thousands of events can be produced. Furthermore, absent knowledge of a software application, for example originating from a specification or other documentation, it is difficult to formulate meaningful queries to explore the events effectively. Event streams also can be dynamically reconfigured further complicating matters.